Fix zizmor code scanning alerts in action.yml - #309
Conversation
Resolves all 15 open code scanning alerts (zizmor `template-injection`
and `github-env`):
- Stop interpolating `${{ inputs.git-*-name/email }}` directly into a
`run:` script; pass them through `env:` instead.
- Replace all `GITHUB_ENV` writes with step outputs. The git identity is
now computed in a single `git-identity` step (signed vs. unsigned) and
the commit message in a `commit-message` step.
- Pass the `GIT_AUTHOR_*`/`GIT_COMMITTER_*` values as `env:` on the
`Run update-flake-lock` step, since git honors them when
`nix flake update --commit-lock-file` creates the commit.
- Pass `GIT_*` as `env:` on the Handlebars step so the documented
`env.GIT_*` template variables in `pr-body` keep working (the action
builds its `env` context from `process.env`).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
Included review availability: 3 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour. 📝 WalkthroughWalkthroughThe action consolidates Git identity setup into one step. It publishes identity and commit message values as step outputs. Update and pull request creation steps consume these outputs. ChangesGit identity output flow
Estimated code review effort: 2 (Simple) | ~10 minutes Merge Risk: ⚪ Minimal · up to The change localizes Git identity and commit-message values to step outputs and environment variables while removing unsafe workflow interpolation and environment leakage; no actionable merge-blocking risk remains after normal checks and review. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Full details: Docstring CoverageExplanation No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.) ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
1 participant
Summary
Resolves all 15 open code scanning alerts, which were zizmor findings in
action.yml:template-injection:${{ inputs.git-author-name }}and friends were interpolated directly into arun:script.github-env: three steps wroteGIT_AUTHOR_*,GIT_COMMITTER_*, andGIT_COMMIT_MESSAGEto$GITHUB_ENV.Changes
git-identitystep that selects the GPG or input-provided identity in bash. Inputs are passed viaenv:rather than interpolated, and the result is written to$GITHUB_OUTPUT.$GITHUB_OUTPUT(steps.commit-message.outputs.message) using the same random-delimiter heredoc as before.env.*:Run update-flake-lockreceivesGIT_AUTHOR_*/GIT_COMMITTER_*viaenv:. This matters becausenix flake update --commit-lock-fileis what creates the commit, and git honors those variables.GIT_*variables viaenv:.pedrolamas/handlebars-actionbuilds its template context from{ ...process.env }, so the documented{{ env.GIT_COMMIT_MESSAGE }}etc. inpr-bodytemplates keep working unchanged.Create PR'sauthor/committeruse the step outputs.TARGETS: ${{ inputs.inputs }}env var from the old signed step.Behavior note
Previously the
GIT_*variables leaked viaGITHUB_ENVinto any steps afterupdate-flake-lockin a caller's workflow. That was never documented (the README only lists them aspr-bodytemplate variables), so this PR does not preserve it. If we know of users relying on it, explicit action outputs would be the right replacement.Verification
zizmor --config .github/zizmor.yml action.yml .github/workflows→ no findings (was 15 high). The pedantic persona shows only one pre-existingsuperfluous-actionsinfo.prettier --check action.ymlpasses.🤖 Generated with Claude Code
Summary by CodeRabbit